GitHub Copilot

Shield360 covers GitHub Copilot in two ways. Each figure on the GitHub Copilot page says which one it comes from.

Source	What it gives	Where it comes from
Measured by GitHub	Daily usage per person, editor, feature, language and model. Seat activity. Copilot audit events.	The GitHub Copilot connector, which reads GitHub’s REST APIs on a schedule.
Observed by Shield360 hooks	Agent sessions, prompts, tool calls, file edits, commits and pull requests, and guard decisions, as they happen.	`shield360 coding hook`, run by Copilot CLI, agent mode in VS Code, and the Copilot cloud agent.
Derived	Ratios worked out from GitHub’s figures, such as the acceptance rate.	The GitHub Copilot page.

Nothing on the page is estimated. GitHub reports no cost per person, so seat costs come from the connector’s seat price, as on the spend report.

Open it from Agents → Agents → GitHub Copilot usage, or go to /coding-agents/copilot. It belongs to the Developer module and needs the View coding agent activity permission. Every view of the page is recorded in the access log.

What can and cannot be seen

Copilot activity	Measured by GitHub	Observed by hooks	Prompt or code text
Inline (ghost-text) completions in any editor	Counts: suggestions, acceptances, lines suggested and added, by editor and language	No: completions run no hook	Never. GitHub does not report it and no hook sees it.
Copilot Chat (ask and edit modes)	Counts by feature and model	No	Never
Agent mode in VS Code	Counts, plus `used_agent` and agent sessions	Yes: prompts, every tool call, file edits, commits and pull requests	Only when your organisation keeps content (see below)
Copilot CLI	Counts, sessions, requests and tokens	Yes, as agent mode	Only when your organisation keeps content
Copilot cloud agent (assigned issues, agent tasks)	Who used it, per day	Yes, when the repository has the hook file and `shield360` is installed in the agent’s setup steps	Only when your organisation keeps content
Copilot code review	Who used it, per day	No	Never
Seats	Every seat, its plan, its last activity, last editor and last sign-in	n/a	n/a
Policy, seat and content-exclusion changes	Audit events (GitHub Enterprise Cloud)	n/a	n/a

Things that are not possible:

Inline completions are not observable. VS Code, JetBrains and other editors give no hook or API for the completion text. Only GitHub’s daily counts exist.
Token counts and cost per prompt in the editor are not reported. VS Code’s hook payload carries no model, no tokens and no user identity. GitHub reports tokens for Copilot CLI only, per day.
The hooks do not see the developer’s GitHub login. They identify people the way every coding agent does: SHIELD360_USER, then git config user.email. GitHub’s reports identify people by GitHub login. The page shows both but does not join them.
The cloud agent’s hooks do not say who assigned the task. Each cloud session runs inside GitHub Actions under GitHub’s identity. GitHub’s daily report says who used the cloud agent.
GitHub’s session-content APIs are not read. The usage-records API and audit-log streaming carry prompts and responses. They need GitHub Enterprise Cloud with managed users. Shield360 doesn’t ingest them, because Shield360 stores no prompt text unless the organisation opts in.
Reports arrive late. GitHub publishes a day’s report after the day is processed, so the latest day is usually yesterday.

Measured by GitHub: the connector

Add or edit the GitHub Copilot connector under Connectors. Besides seats and seat costs, it reads:

Setting	Default	Reads	GitHub endpoint
Read usage metrics	On	Each day’s per-person report (interactions, code suggestions and acceptances, lines suggested and added, agent, chat, CLI and cloud-agent use, CLI tokens, splits by editor, feature, language and model) and the organisation’s daily totals. The first sync reads 28 days. Later syncs re-read the last 3.	`GET /orgs/{org}/copilot/metrics/reports/users-1-day` and `organization-1-day`
Read Copilot audit events	Off	`copilot.*` audit-log events: seat assignments and cancellations, policy changes, content-exclusion changes. The first sync reads 90 days.	`GET /orgs/{org}/audit-log?phrase=action:copilot`
GitHub enterprise (optional)	Empty	Reads metrics and audit events for the whole enterprise instead of the organisation. Seats are still read from the organisation.	`/enterprises/{enterprise}/…`

The reports come as signed download links. Shield360 downloads them without sending your token, because the links are already signed. It keeps counts and identifiers only. For an audit event that means the action, who did it, the target person or team, and the time. IP addresses, user agents and request details are dropped.

Token access

Seats: manage_billing:copilot or read:org, or a fine-grained token with GitHub Copilot Business set to read.
Usage metrics for an organisation: the Copilot usage metrics policy must be enabled. You also need an organisation owner’s token with read:org, or a fine-grained token with View Organization Copilot Metrics.
Usage metrics for an enterprise: the enterprise policy must be Enabled everywhere, and the token needs manage_billing:copilot or read:enterprise.
Audit events: GitHub Enterprise Cloud, and read:audit_log.

A missing permission doesn’t stop the sync. Seats and costs are still written, and the sync message names what was not read: Copilot usage metrics not read: HTTP 403 … or Copilot audit log not read: ….

Observed by hooks: Copilot CLI and VS Code

shield360 coding install --vendor=copilot

This writes ~/.copilot/hooks/shield360.json. Copilot CLI runs it. Agent mode in VS Code reads the same folder (the chat.useHooks setting, on by default) and runs it too, with VS Code’s own payload. Shield360 recognises each format and answers in it.

	Copilot CLI	Agent mode in VS Code
Prompt guard	Recorded, never blocked: Copilot CLI can’t stop a prompt from a hook	Blocks with `continue: false` when the policy says block
Tool guard, edit policies, sequence policies	Denies the call	Denies the call
Prompt-injection check on tool results	Replaces the result	Tells the model to disregard it
Session row	Ends on `sessionEnd` with its outcome	VS Code has no session end: the row is updated from each `Stop`, at most once a minute
Surface on every span	`coding_agent.client.surface = cli`	`coding_agent.client.surface = vscode`

Both appear as GitHub Copilot (coding_agent.client = copilot) in Agents, Sessions and Users, like the other coding agents. Edits are recorded as line counts and line fingerprints, never the lines. Copilot applies an agent’s edits as it goes, and no hook reports whether the developer keeps or undoes them, so each edit is recorded as auto_accepted.

Content. Prompt text, tool arguments and results, and error messages are sent only in full capture. That needs your organisation’s data retention setting to keep content. Otherwise the spans carry names, counts and the action type only.

Observed by hooks: the Copilot cloud agent

The cloud agent runs the hooks in .github/hooks/*.json from the repository’s default branch, inside its GitHub Actions sandbox.

Write the hook file

shield360 coding install --vendor=copilot --repo /path/to/checkout

This writes .github/hooks/shield360.json. Each entry runs shield360 coding hook --vendor=copilot --surface=cloud-agent only if shield360 is installed. The cloud agent treats a failing hook as a denial, so without the guard a missing binary would stop every tool call. VS Code also reads .github/hooks, and skips this file, because the developer’s own install already covers VS Code.

Install shield360 in the agent's setup steps

Add a step to .github/workflows/copilot-setup-steps.yml that installs the CLI. It needs SHIELD360_OTLP_ENDPOINT and SHIELD360_API_KEY, which you add as secrets of the repository’s copilot environment:

jobs:
  copilot-setup-steps:
    runs-on: ubuntu-latest
    environment: copilot
    steps:
      - name: Install Shield360 CLI
        run: curl -fsSL https://app.shield360.ai/api/cli/install.sh | sh

Replace app.shield360.ai with your own address if you self-host.

Commit both to the default branch

Cloud sessions then appear with the surface Cloud agent. In the cloud agent, a guard answer of “ask” is a denial, because there is nobody to ask.

MCP servers for the cloud agent. The cloud agent’s MCP servers are configured in the repository’s Settings → Copilot → Coding agent page, not in a file. To give it governed tools through Shield360’s MCP gateway (/api/mcp, see Data gateway), create an agent under Govern → Agent access and add the gateway there as a remote MCP server. Keep the agent’s token in a secret of the copilot environment whose name starts with COPILOT_MCP_, which is the only kind GitHub passes to MCP configuration.

Privacy

Per-person rows on the GitHub Copilot page follow the same cohort floor as the rest of Agents. Viewers who aren’t admins see people active on fewer than five days by number, not by login. They also see audit actions without names.
The connector token is stored encrypted, or read from the Vault, and is never returned or logged.
No table written by the connector holds a prompt, a completion or code.